Self-Hosted CISO Assistant: From Fresh Install to a Working ISO 27001, GDPR and NIS2 Portal

Most CISO Assistant installation guides stop too early.

They show you how to start the containers, open the login page and create an administrator.

Then you are looking at an empty GRC platform.

Now what?

It shows the sequence we use to turn a fresh self-hosted CISO Assistant installation into a usable GRC portal.

The examples come from a real Community Edition deployment. Menu names below correspond to CISO Assistant v4.x and can move slightly between releases.

The sequence is:

1. Log in and secure the administrator account

Open your CISO Assistant URL.

For example:

Sign in with the administrator account created during installation.

Do not start creating compliance data yet.

First secure this account.

Open your user menu.

Open your profile.

Change the initial administrator password.

Store the new password in your password manager.

Check before continuing

You should now have:

Later we will create named administrator accounts.

2. Configure the basic portal settings

There are several settings here that are easier to configure now than after you have created hundreds of records.

Email notifications

Asset security scale

For example, our deployment used:

0–3

because the customer’s existing asset register rated confidentiality, integrity and availability from 0 to 3.

Do this before importing assets.

Changing the scale after the asset inventory has been entered creates unnecessary cleanup work.

Partially compliant results

It is useful during migration because many controls are neither completely absent nor fully evidenced.

Self-validation

Set this to:

Off

The person creating or changing compliance material should not automatically approve their own work.

MFA enforcement

Personal domains

Leave this:

Off

For a corporate ISMS, objects should live in deliberately designed organisational domains, not personal workspaces.

Save the settings.

3. Enable the modules you are actually going to use

Organization

Turn on:

Operations

Turn on:

Management and Governance

Turn on:

Reports is particularly important because it exposes the Statement of Applicability report later.

Compliance

Turn on:

Risk management

Turn on:

GDPR / Privacy

Turn on:

Extra

Turn on:

Save.

Check

Look at the left sidebar.

You should now see additional areas including things such as:

• Risk
• Compliance
• Operations
• Privacy
• Third parties
• Reports

If Reports is not visible, go back and check the feature flag.

Do not proceed to building the ISO audit until Reports is available.

4. Configure SSO

For a company deployment, do this before creating the normal user population.

The exact identity-provider configuration depends on what you use.

A common setup is Microsoft Entra ID with SAML.

First create the Enterprise Application in Entra.

Copy from Entra:

• Microsoft Entra Identifier
• App Federation Metadata URL

Now return to CISO Assistant.

Fill:

IdP Entity ID
Paste the Microsoft Entra Identifier.

Metadata URL
Paste the App Federation Metadata URL.

SP Entity ID
Use the same external identifier configured in Entra.

Review the attribute mappings.

At minimum, verify that email/UID mapping is correct.

Enable:

SSO auto-provisioning / JIT

With JIT enabled, a new person can be created on first SSO login.

That does not mean the new person should automatically receive access to the ISMS.

The account should initially have no useful permissions until you assign the appropriate group.

Save.

Test it before forcing SSO

Open a private/incognito browser.

Sign in using a normal corporate account.

You should arrive in CISO Assistant.

Log out.

Now test the local emergency administrator account again.

Both should work.

Only after both tests succeed should you enable any setting that forces normal users through SSO.

Common problem: “User not declared”

Check that JIT provisioning is enabled.

Common problem: only some people cannot log in

Check email address casing and mapping between the identity provider and CISO Assistant.

Common problem: login redirects to HTTP or an internal backend hostname

That is normally an external URL / reverse-proxy header problem.

Fix the deployment configuration before continuing.

Common problem: error 500 after SAML login

Recheck:

• Entity ID;
• metadata URL;
• Reply URL;
• attribute mappings.

Do not continue until SSO works reliably.

5. Configure email and test it

CISO Assistant needs email for more than marketing-style notifications.

It is used for operational things such as:

• password reset;
• evidence expiry;
• task notifications;
• due dates;
• findings.

SMTP is configured at deployment level rather than entirely through the web interface.

Use a dedicated service mailbox.

Do not use an employee’s personal mailbox.

After SMTP has been configured on the host, return to:

If mail does not arrive, fix it now.

Do not create external local users until password reset and notification email work.

6. Take the first backup

Before building the ISMS, take a known-good backup.

Rule for the rest of the implementation

Take another backup:

• before large imports;
• before risk migration;
• before mass API changes;
• after completing each major phase.

Do not learn whether your backup works on the day you need it.

7. Create the organisational domains

Now we create the access structure.

Example:

Name

Description

Create IAM groups
On

Click Save.

Now create other domains only where a real access or ownership boundary exists.

For example:

• Company - Technology
• Company - Operations
• Company - Finance

Do not reproduce your entire organisation chart simply because you can.

Domains are primarily access boundaries.

Check

For each domain, CISO Assistant should have created role groups such as:

• Analyst
• Approver
• Domain manager
• Reader
• Respondent
• Technical tester

If those groups were not created, go back and check whether Create IAM groups was enabled when the domain was created.

8. Create the ISMS perimeter

A domain is not the ISO 27001 scope.

Create the scope separately as a perimeter.

Example:

Name

Description
Paste the actual approved ISO 27001 scope statement.

Do not write:

unless that is genuinely your approved scope.

Use the wording from your ISMS documentation or certificate.

Domain

Reference ID

Status

Use Production if this is an already operating ISMS.

Use Design only if the scope genuinely has not gone live yet.

Save.

If you need them, create additional perimeters such as:

• GDPR-Processing
• TECH-Platform
• OPS-Production
• FIN-Systems

Important

Perimeters are not the same as access boundaries.

If access must be separated, use domains.

9. Remove the demonstration data

Do this before you start putting real company data into the portal.

A fresh installation may contain demonstration objects.

Look for demonstration data such as:

Open it.

Check which objects are linked to it.

Remove the linked demo:

• audits;
• risk assessments;
• assets;
• other sample records.

Then delete the demonstration perimeter.

Check

Search the portal for the sample company name.

Nothing belonging to the sample organisation should remain.

You do not want a fictional SaaS startup appearing in an export given to your ISO auditor.

10. Create your named administrator

Stop using the break-glass account for normal work.

Open:

User groups

Add:

Log out.

Log back in using your named account.

Confirm that you can administer the portal.

From this point, keep the original administrator only for emergencies.

11. Let normal users arrive through SSO

If JIT provisioning is enabled, do not manually create everybody.

Ask the first ISMS user to sign in using SSO.

Open:

User groups

Assign the required role.

For example:

Check permissions

Use a non-administrator test account.

Confirm that the account can see what it is supposed to see.

Confirm that it cannot edit objects outside its role.

Do this now.

12. Check the framework libraries

Open:

Loaded libraries

Search for:

Confirm that:

International standard ISO/IEC 27001:2022

is loaded.

Search:

Confirm that GDPR is loaded if you need the privacy assessment.

Search:

Check which NIS2 framework/mapping libraries are present for your version.

Do not unload libraries simply because you are not using them.

Unused mapping libraries do nothing until you actually apply them.

Check the risk matrix

If it uses its own approved matrix, stop here and import that matrix before creating risk assessments.

Once a risk assessment is created with a matrix, changing it later is not a trivial correction.

13. Import a custom risk matrix if required

If your existing risk methodology uses its own matrix, prepare it as a CISO Assistant library.

Now open:

Loaded libraries

Find your matrix library.

For a 4×4 matrix, check at least:

• low probability + low impact;
• high probability + high impact;
• the treatment-threshold cells.

Do not assume the rows and columns were interpreted correctly.

Check

14. Start the ISO 27001 journey

If your version contains the ISO 27001 journey, use it.

Click:

Start a journey

Choose:

ISO 27001:2022 — Full Implementation

Select:

Use an existing domain

Choose your ISMS domain.

Enable:

Create underlying objects

This is important.

If you leave this unchecked, the journey is mainly a checklist.

If you enable it, CISO Assistant creates useful underlying objects.

Leave:

Adjust menu and modules

unchecked if you have already configured your feature flags manually.

Start the journey.

Now inspect what it created

Go through the objects created by the journey.

It may create:

• ISO issues;
• objectives;
• an ISO 27001 audit;
• task templates;
• metrics;
• applied controls;
• a risk assessment;
• a findings binder.

Do not accept everything blindly.

If it created a risk assessment using the standard 5×5 matrix but your organisation uses a custom 4×4 matrix:

Check

15. Create the ISO context issues

Example:

Name

Category
Choose the appropriate category.

Origin

Status

Description
Explain why this affects the ISMS.

Save.

Create the next issue.

Examples include:

• cyberattack environment;
• cloud dependency;
• staff turnover;
• legal obligations;
• market requirements;
• AI adoption;
• reliance on key suppliers;
• climate-change relevance.

Do not write a textbook SWOT analysis here.

Use the organisation’s actual context assessment.

16. Create interested parties

For each significant interested party, create an Entity.

Examples:

• management;
• employees;
• customers;
• suppliers;
• contractors;
• regulators;
• ICT suppliers.

For each entity, put into the description:

• needs;
• expectations;
• requirements;
• how the ISMS addresses them.

Save.

This gives clause 4.2 somewhere structured to live instead of leaving the entire analysis inside one Word file.

17. Create ISO security objectives

Examples:

• complete two phishing simulations;
• achieve a defined MFA coverage;
• perform an annual disaster-recovery test;
• close a specific audit finding;
• reduce high-risk vulnerabilities within the defined SLA.

Enter:

• objective;
• owner;
• target;
• dates;
• status.

Save each one.

18. Import the asset inventory

Take a backup first.

Example:

Name

Description
Explain what the organisation uses it for.

Business value
Explain why the service matters.

Owner
Select the accountable person.

Domain
Choose the correct organisational domain.

Type
Choose Primary or Supporting.

Use Primary for important business services/information.

Use Supporting for systems, software, infrastructure, people or facilities that support those services.

Set the security objectives.

For example:

Confidentiality
2

Integrity
3

Availability
3

If you maintain recovery targets, enter:

• RTO;
• RPO;
• MTD.

Add useful labels such as:

• type:saas
• criticality:critical
• classification:confidential
• subprocessor:yes

Save.

Load order

Do this in this order:

1. business services;
2. important information assets;
3. supporting systems;
4. infrastructure;
5. important SaaS platforms;
6. hardware where it matters to the risk model.

This allows you to link supporting assets to their parent services.

Check

Open the Assets list.

Verify that each important asset has:

• an owner;
• a domain;
• C/I/A values;
• classification;
• recovery data where required.

If an availability-critical service has no recovery target, fix that before continuing.

19. Create policies as managed objects

Example:

Name

Reference ID

Owner
ISMS Manager

Status

Use Active only if an approved document really exists.

Set:

Start date

Set:

Expiry date

Use the expiry date as the next mandatory review date.

Attach the approved document.

If the authoritative copy stays in SharePoint, put the SharePoint address into:

Link

Save.

Repeat for the main policies:

• Information Security
• Acceptable Use
• Access Control
• Password / Authentication
• Cryptography
• Classification
• Retention
• Backup
• Disaster Recovery
• Asset Management
• Physical Security
• Risk Management
• Vulnerability Management
• Incident Management
• Security Awareness
• Data Protection
• Supplier Security
• Change Management

Add others that actually exist in your organisation.

Check

20. Configure applied controls

Set:

Owner

Set:

Status

Use:

• To do
• In progress
• On hold
• Active
• Degraded
• Deprecated

Only use Active when the control really operates.

Example:

Open the control corresponding to access management.

Set the owner to the security manager.

Add a description of what the organisation actually does.

For example:

Link relevant assets.

Set dates if appropriate.

Save.

Repeat for the real controls.

Important rule

Do not describe the ISO requirement again.

Describe your implementation.

21. Create the recurring control tasks

Name

Recurrent
Yes

Frequency
Every 3 months

Assigned to
Security Manager

In the description, write the actual procedure.

For example:

1. export active users from the identity provider;
2. export privileged-role assignments;
3. compare with active employees;
4. identify inactive or unjustified access;
5. ask the responsible manager to confirm retain/remove/change;
6. implement changes;
7. attach the completed review.

Link the task to the access-control applied control.

Save.

Now create the rest of the real operating calendar.

At minimum consider:

22. Create the real risk assessment

Now that the assets, controls and matrix exist, create the risk assessment.

Example:

Name

Reference ID

Perimeter

Version

Status

Risk matrix
Select the matrix approved for your organisation.

Be careful here.

The matrix is an important structural choice.

Check it before saving.

Set:

Authors

Set:

Reviewers

Set:

Due date

Set:

Risk tolerance

according to the approved methodology.

Save.

23. Enter a risk scenario — click by click

Example:

Name

Risk assessment
Select the assessment you just created.

Reference

Threat
Select the appropriate threat.

Click Save.

Now open the scenario.

Click Edit.

Set:

Owner

Select the relevant asset.

Select or create the vulnerability.

Example:

Now go to the Current risk section.

Choose the relevant existing controls.

Set:

Current probability

Set:

Current impact

CISO Assistant should calculate the risk level from the matrix.

Now go to Residual risk.

If treatment is required, add an extra control.

Example:

Set:

• owner;
• priority;
• ETA;
• cost if used;
• status.

Now set the expected residual probability and residual impact.

Set:

Treatment status

For example:

Add the justification.

Save.

Check

The treatment control should also appear in:

24. Create formal risk acceptance

Where residual risk is being accepted, do not leave the decision buried in a meeting minute.

Enter:

Name

Approver
The management user authorised to accept the risk.

Risk scenarios
Select the scenarios being accepted.

Justification
Reference the treatment decision.

Expiry date
Set the next review date.

Save.

Check for problems such as:

• scenario says Accepted but has no acceptance;
• acceptance has expired;
• other inconsistent risk states.

Fix the X-rays before continuing.

25. Configure the ISO 27001 audit

Enter:

Name

Reference ID

Perimeter

Target framework

Selected implementation groups

Choose both:

• Clauses
• Statement of Applicability (SoA)

Version

Status

Authors
ISMS team

Reviewers
Management / internal auditor

If you have not already generated framework controls, enable:

Suggest controls

Save.

Check

The audit page should contain:

You should see requirements covering clauses 4–10 and the Annex A controls.

26. Assess one ISO control properly

Do one control completely before trying to fill 93 rows.

scroll to:

Associated requirements

Open:

5.15 Access control

A panel opens.

Open the:

Applied controls

tab.

Attach your existing access-control implementation.

Do not create another duplicate control unless one genuinely does not exist.

Open:

Evidences

Link evidence if appropriate.

Now fill:

Observation

Write the actual justification.

This text later feeds the Statement of Applicability.

Save.

Your rule for Compliant

Use Compliant only when:

If something is still being remediated, use Partially compliant or Non compliant as appropriate.

Do not mark it compliant because “we have a policy about it.”

27. Build the Statement of Applicability

Work through Annex A.

For each control:

1. open the requirement;
2. decide applicability;
3. attach the relevant applied control;
4. attach current evidence;
5. write the justification;
6. set Result;
7. set workflow Status;
8. save.

For example, if outsourced software development genuinely does not occur:

Do not enter:

That is not a justification.

28. Export the real SoA

Choose:

Statement of Applicability

Select your audit.

Optionally select the relevant risk assessments.

Select the SoA implementation group.

Click:

Render

Review the columns.

You should see information such as:

• reference;
• applicable;
• justification;
• implementation;
• reference control;
• additional controls;
• risk coverage.

Now export the report to PDF.

Open the PDF.

Read several rows.

Make sure the Observation text you entered actually produces a useful SoA.

If the PDF is full of empty or useless justifications, go back to the audit and correct the records.

29. Add evidence from the control

The easiest way to manage evidence is from the control it supports.

Open the:

Evidences

tab.

Click:

+ Add evidence

Example:

Name

Description

Upload the attachment or add the controlled source link.

Set:

Owner

Set:

Status

For approved evidence:

Set:

Expiry date

For a quarterly access review, use roughly three months.

Save.

Renew evidence correctly

Three months later, do not create:

Open the existing evidence record.

Add a new revision.

Attach the new quarter’s file.

Record the version/date.

Keep one stable evidence object and renew it with revisions.

That gives you history without filling the system with duplicate records.

30. Test evidence expiry

Create a temporary evidence item with a near expiry date.

Verify that it appears in the appropriate watch/expiry views.

The operating model should be:

current evidence → valid control proof.

expired evidence → requires review.

The system should make stale evidence visible.

Do not rely on somebody remembering the date from the filename.

31. Build the GDPR register

Enable the Privacy features first if you have not already done so.

Now use this order.

Purposes

Create purposes such as:

• customer service delivery;
• employee administration;
• invoicing;
• marketing;
• supplier management.

Save.

Personal data

Examples:

• employee identification data;
• customer contact data;
• billing information;
• authentication logs.

Set retention and sensitivity where available.

Save.

Processing activities

For each processing activity fill:

• name;
• description;
• legal basis;
• data subjects;
• personal-data categories;
• purposes;
• recipients;
• international transfers;
• retention;
• owner;
• security measures.

For security measures, link the applied controls that already exist.

Do not rebuild separate GDPR access-control and encryption controls if the ISO controls already perform the job.

Save.

32. Test a data-subject request

For example:

Enter only the personal information required to manage the request.

Set:

Received date

Set:

Due date

according to the legal/procedural requirement.

Assign the owner.

Link the relevant processing activity.

Save.

Now make sure the due date is visible to the responsible user.

Once confirmed, remove the test record if it is not a real case.

33. Configure the breach register

You should know where to record:

• detection time;
• description;
• affected data;
• affected people;
• consequences;
• containment;
• notification decision;
• authority notification;
• communication to affected people.

Do not discover the data-breach form for the first time during an incident.

34. Create the GDPR audit

That is one of the main reasons for using a GRC platform instead of separate GDPR and ISO spreadsheets.

35. Build the supplier register

Enter:

Name

Description

Domain

Mission

Owner

Set the available criticality/risk inputs.

Save.

For example:

Entity:

Solution:

Another example:

Entity:

Solution:

Set:

• start date;
• renewal/expiry where applicable;
• owner.

Attach or link the contract/DPA as evidence.

36. Create a supplier assessment

Example:

Name

Perimeter

Entity

Framework / questionnaire
Choose the vendor questionnaire you use.

Authors

Reviewers

Representative
If the supplier will answer directly.

Expiry date
For critical/high suppliers, normally set the next required review date.

Complete the assessment.

Set the conclusion.

Save.

Check

The supplier record should now tell you:

If the answer to any of those is “look in the supplier folder,” migration is not finished.

37. Configure incidents

Your incident record should capture at least:

• name;
• description;
• severity;
• status;
• detection source;
• owner;
• affected assets;
• evidence;
• timeline.

If your operational ticket remains in Freshservice, Jira, osTicket or another tool, keep it there.

Use CISO Assistant to hold the GRC record and link to the operational ticket.

Do not force your technical incident team to abandon a working incident-response tool merely because the GRC platform has an Incident object.

38. Create findings binders

Examples:

• External certification audit 2026
• Internal audit 2026
• Penetration test 2026
• Vulnerabilities
• Continuous control monitoring

Now create the findings.

For each finding record:

• original finding;
• reference;
• related requirement;
• owner;
• priority;
• target date;
• root cause;
• corrective control.

Do not mark the finding Closed merely because somebody says it has been fixed.

Attach effectiveness evidence first.

Then close it.

39. Configure security exceptions

Example:

Name

Description
Explain the actual exception.

Owner

Approver

Severity

Status

Expiration date

Link:

• affected control;
• affected asset;
• risk scenario;
• compensating evidence.

Save.

40. Run the internal audit from the portal

Before the internal audit, create a Reader account for the auditor or provide controlled exports.

The auditor should work from the current ISO audit.

When the audit has been formally signed off:

then enable:

Locked

Now the year’s assessment is frozen.

Do not keep editing the signed-off audit.

For the next cycle, create a new audit using the previous one as the baseline.

41. Prepare the management review from live data

Export:

• open actions;
• audit status;
• findings;
• SoA;
• supplier assessments;
• risk assessment;
• objectives;
• metrics.

The management review should consume this live information.

After the meeting, every management decision that requires work should become either:

• an applied control;
• a task;
• a risk decision;
• a finding/action.

Give it:

• an owner;
• an ETA.

Attach the approved meeting minutes as evidence against ISO 27001 clause 9.3.

42. Configure the system for day-to-day operation

At this point the installation is no longer the project.

Running it is.

Review:

Risk acceptances

Someone must renew or revoke expiring acceptances.

If nobody owns those activities, the portal will slowly turn back into the same stale compliance system you were trying to replace.

43. Four weeks before the certification or surveillance audit

Run this checklist in the portal.

Policies

Open the Governance watch list.

There should be no unexplained expired policy.

Evidence

Filter evidence for expired or missing records.

Renew what is legitimately due.

Do not backdate evidence.

Applied controls

Filter for:

Degraded

Investigate every one.

Tasks

Risks

Open each risk assessment.

Check that it has been reviewed within the required cycle.

Check High/Very High residual risks.

Findings

Open the last certification/internal audit binder.

Every finding claimed as closed should have effectiveness evidence.

Statement of Applicability

Internal audit and management review

Make sure both have occurred within the required cycle and that their evidence is attached.

Suppliers

Check that required annual supplier reviews are complete.

Owners

Check that controls, risks, policies and evidence do not belong to somebody who left six months ago.

44. Give the external auditor access

If the auditor needs portal access:

Set an:

Expiry date

Add:

Reader

on the required domains.

Do not give Analyst or Administrator because it is easier.

Test the auditor account yourself before the audit begins.

If force-SSO is enabled and the auditor is external, either:

• invite the auditor through your identity provider as a guest;
• or use controlled exports.

After the audit, remove their access.

Keep the removal record as access-review evidence.

45. What “finished” looks like

You do not have a finished CISO Assistant deployment because the home page opens.

You have a finished first implementation when somebody can open the portal and answer:

That is the point.

Where Futurion Solutions comes in

This is also why our CISO Assistant work is not sold as a Docker installation.

We deploy the platform, but the deployment is only the beginning.

The actual engagement covers:

That includes taking the existing Excel/Word/SharePoint system and turning it into the objects described in this guide: domains, perimeters, assets, policies, controls, risks, audits, evidence, supplier assessments, findings and recurring work.

Where useful, we then connect the portal to the systems that already contain compliance evidence so recurring checks do not depend on somebody exporting the same report every month.

The finished result should be something the client’s own team can operate after handover.